ADFS claims configuration in a federated environment

Question

Im trying to use ADFS authentication, but I have some doubts about where the configuration should be made.

In my company side there is an ADFS configured with an Active Directory. Im able to use oauth and authenticate users from that AD: I get an access token and an id_token.

I also have the need to authenticate users from another company, which also have an ADFS. So, I beleive there is a federation between both. In my ADFS side we have created a Claims Provider Trust for that ADFS. Im able to get an access token using oauth. However, Im not able to get an id_token. I cant also get some user information (claims) inside the access token.

I tried everything I could in my ADFS side, more concretly I applied a passthru to all claims in both the Claims Provider Trust and the Application Group. Hoerver, I was only able to see additional claims not related with user information.

So my first question is: because the user is authenticated in the external ADFS, isnt the responsability of this ADFS to include the needed claims? If yes, then that explains why may changes on my own ADFS only result on the addition of standard claims.

Does this also means that the AnchorClaimType should be added in the external ADFS and not in my own? (see: ADFS + OpenID Connect email claim and external ADFS) Because I tried everyting and I still get the same error. It only works with my own Active Directory.

thank you!

Answer 1

I figured it out:

In the external ADFS (the one that will authenticate the user) configuration, there is a relying party. This must provide the needed claims. So we need to ask for the admin of the external ADFS to set this. I ask for the name and upn claims.

In my company side it was created a Claims Provider Trust for the external ADFS and an Application Group for oauth authentication. In both we can filter claims, so in both the needed claims must be available: name and upn.

With these claims (or just one of them or any other claim related with user info), the user info will be made available in a token. By default, ADFS doesn´t return user id information.

Finally, regarding the AnchorClaimType claim, this must be set in my company ADFS. This must point to the name or the upn claim. With this claim configured, an id_token will be available.

regards